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1,0 PURPOSE AND APPLICABILITY 

The purpose of the BSL-3 / BSL-4 Security Plan for the National Emerging Infectious Diseases 
Laboratories (NEIDL) located at the Boston University Medical Campus (BUMC) is to establish 
policies and procedures that ensure the physical security of the NEIDL and the control of Select 
Agents and Toxins against unauthorized access, theft, loss, and release. This Plan establishes 
security standards in accordance with U.S. Department of Health and Human Services (DHHS) and 
U.S. Department of Agriculture (USDA) Rules and Regulations on the possession, use, and transfer 
of Select Agents and Toxins (42 CFR Part 73. 7 CFR Part 331 . and 9 CFR Part 121) and the Boston 
Public Health Commission’s Biological Laboratory Regulation. 

The development of the Security Plan started during the design phase of the NEIDL, in that planned 
protective measures were incorporated into the development of building systems and infrastructure, 
and the building’s construction. Those early decisions led to operational planning during design so 
that the eventual protection of the NEIDL included a thoughtfully designed mix of a safe and 
securely built environment, the installation of technologies that allow for different levels of 
physical security, and an operations and staffing plan that utilizes the technology and manages the 
environment. 

The development of the Security Plan continued in concert with other plans addressing 
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comprehensive emergency management, transportation of hazardous materials, and other areas 
related to biosecurity. 

The Security Plan, as implemented through the design, construction, commissioning, and operations 
of the NEIDL has included a deliberate and thorough use of protective layers, beginning with the 
NEIDL site perimeter fencing system. As those with authorization pass through these layers, they 
progress through a variety of security checks, including those done by armed NEIDL Public Safety 
officers, those enforced by card or biometric access systems, those monitored and recorded by 
closed circuit television, and those requiring additional staff—as outlined in the two-person 
guideline of the Personal Suitability and Reliability Policy (attached). These and other security 
technologies are safeguards that are in place at the NEIDL to prevent unauthorized access, theft, 
loss, or release of moderate-to-high-risk Select Agents and Toxins that require containment in BSL- 
3 and BSL-4 laboratories and suites. 

Select Agents and Toxins are subject to distinct levels of protection. The NEIDL meets or exceeds 
the federal, state, and local requirements for each of these levels. The determination of compliance 
with required protection, including Tier 1 agents, is the responsibility of the Responsible Official 
and the Executive Director of Public Safety. 

2.0 ROLES AND RESPONSIBILITIES 
2.1 Public Safety Personnel 

The Executive Director of Public Safety is responsible for all Boston University Police and Public 
Safety functions at both the Charles River and the Medical Campuses, including the NEIDL. The 
Public Safety Supervisors and Managers assigned to the NEIDL are responsible for providing 
supervision of Public Safety Officers 24 hours a day, 7 days a week, and for initiating notification 
procedures involving responses for all phases of an emergency occurring in and around the NEIDL. 
They are also responsible for notifying the BU Public Relations department of any security 
incidents that may require a public safety advisory. In addition, they are responsible for 
coordinating with other public safety organizations. 

2.1.1 NEIDL Public Safety Officers 

The Public Safety Officers assigned to the NEIDL are responsible, 24 hours a day, 

7 days a week, to control access to the NEIDL in accordance with established 
protocols and to respond to all emergencies and incidents. Emergencies and 
incidents include: 1) loss, theffor release of Select Agents or Toxins; 2) 
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unauthorized personnel entry; and 3) any security system alarms and video 
breaches on the grounds and at pedestrian and vehicle entry points. The Public 
Safety Officers are also responsible for: 1) complying with the protocols and 
procedures in the Public Safety Policy and Procedure Manual; 2) attending all 
training programs and drills appropriate to their responsibilities; 3) ensuring that all 
security-related equipment is functioning at all times; and 4) reporting 
malfunctions immediately to the Boston University Control Center for response 
and repair. 

2.1.2 Boston University Police Department 

The Boston University Police Department (BUPD) is the primary law enforcement 
entity for Boston University. The Department is responsible for responding, 
consistent with the requirements of the notification system, to any security incident 
or police matter that necessitates additional resources up to and beyond what is 
currently available at the NEIDL. Boston University Police Department participate 
in all contingency emergency-phase planning prior to and following a security 
incident involving the NEIDL. 

2.1.3 Public Safety Audit / Access Coordinator 

The Public Safety Audit / Access Coordinator is responsible for: 1) accepting all 
requests for access to the NEIDL; 2) ensuring confirmation of all necessary 
background requirements, credentials, and approvals; 3) issuing, control and return 
of NEIDL identification badges; and 4) monitoring entry locations for each badge 
entering the NEIDL. 

2.1.4 Public Safety Systems Integration Coordinator 

The Public Safety Systems Integration Coordinator is responsible for managing 
records and ensuring the operational integrity of the building and security 
information systems, including but not limited to access control, closed-circuit 
television, and record retention and storage. 

2.2 Director of Information Technology and Telecommunications 

The NEIDL Core Director of Information Technology and Telecommunications, with oversight by 

Boston University Information Services & Technology (IS&T), is responsible for developing. 
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implementing, and ensuring the operational integrity of the secure NEIDL laboratory data and 
information systems. 

2.3 Principal Investigator 

The Principal Investigator (PI) is an authorized individual approved by the Responsible Official 
(RO). The PI is responsible for the scientific and technical direction of a Select Agent or Toxin 
project or program. Security responsibilities of the PI include: 1) ensuring that all authorized 
individuals under his or her direction comply with and maintain all BU security provisions, such as 
implementing proper Select Agent or Toxin registration; receipt and handling procedures; 
successful completion of security training and drill exercises; adhering to all appropriate Standard 
Operating Procedures (SOPs) in performing their work; and correct use of Select Agent or Toxin 
access and inventory procedures; and 2) reporting all incidents, accidents, and exposures related to 
Select Agent or Toxin materials to the Responsible Official and the Research Occupational Health 
Program. . 

2.4 Responsible Official 

The Responsible Official (RO) is an authorized individual with responsibility, authority, and 
control to ensure compliance with the DHHS and USDA Rules and Regulations pertaining to the 
possession, use, and transfer of Select Agents and Toxins. BU/BMC designated the Director of 
Research Safety to serve as the Responsible Official. The Director of Research Safety is a voting 
member of the Institutional Biosafety Committee. 

2.4,1 Environmental Health & Safety 

The Boston University Environmental Health & Safety (EHS) department is responsible for 
the management of the NEIDE’s Select Agent Program as well as all site-specific EHS 
functions and, within the NEIDL, reports to the Director of Research Safety. Thi s 
responsibility includes providing safety and security training for: 1) all individuals approved 
by the Responsible Official to possess, use, and transfer Select Agents and Toxins; 2) BU 
staff who support the operations and maintenance of the NEIDL; 3) individuals who 
respond to incidents at the NEIDL; and 4) individuals who protect the perimeter security of 
the NEIDL. 

2.5 Associate Vice President for Research Compliance 

The Associate Vice President for Research Compliance (AVP-RC) has responsibility for the 
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Animal Services Center (ASC), Environmental Health & Safety (EHS), the Research Occupational 
Health Program (ROHP), the Institutional Biosafety Committee (IBC), the Laboratory Safety 
Committee (ESC), the Institutional Animal Care and Use Committee (lACUC), and other research- 
related oversight committees. 

The AVP-RC, or his or her designee, serves as an Associate Director of the NEIDL and has 
responsibility for services listed above as well as the Emergency Response Planning, Facilities, and 
Public Safety Cores. 

The AVP-RC serves as the Responsible Official (RO) for the City of Boston’s Public Health 
Commission Biological Laboratory Regulation and has appointed the Director of Research Safety 
as the Responsible Official for DHHS and USDA Rules and Regulations, as reflected in section 2.1 
above. The AVP-RC develops and ensures communication between the IBC, IRB, and lACUC- 
sponsored research offices, and regulatory agencies (e.g.. City of Boston, CDC). 

3.0 SECURITY PROCEDURES 

3.1 Nature of Potential Threat 

Examples of potential threats include: 1) theft of a Select Agent, Toxin, or sensitive information; 2) 
unintentional loss or release of a Select Agent or Toxin; and 3) nefarious misuse of a Select Agent 
or Toxin. 


Note: Any loss or theft of a Select Agent or Toxin must be reported to the RO immediately. 
The RO [as defined by CDC) will notify the BPHC immediately and the CDC within 24 
hours using the appropriate APHIS/CDC Form 3. 


3.2 Sources of Potential Threat 

Examples of sources of potential threats include: 1) intrusion by an unauthorized individual not 
affiliated with the NEIDL; 2) intrusion by an unauthorized individual affiliated with the NEIDL; 3) 
access to a Select Agent or Toxin by an unauthorized individual; and 4) access to a Select Agent or 
Toxin by an authorized individual for the purpose of illegal activity. 
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3.3 Controlling Threat, Vulnerability, and Risk 

Security procedures that prevent unauthorized access to Select Agents and Toxins can reduce 
threat, vulnerability, and risk. Security assessments for controlling access to the NEIDL grounds, to 
the NEIDL facility, to BSL-3 laboratories and BSL-4 laboratories and suites within the NEIDL 
facility, and to Select Agent storage, information, and research data led to the development of 
security methods for Inventory Control, Area Access Control, and Container Access Control. The 
following sections address these security methods for controlling access to Select Agents and 
Toxins. 


3.3.1 Inventory Control System 

An electronic inventory control system tracks detailed information on every transaction that 
involves accessing Select Agents and Toxins from a secure container used for storing Select 
Agents or Toxins (i.e., lockbox, refrigerator, or freezer). The detailed information includes 
the identity and strains of Select Agents and Toxins; the quantities received, removed, and 
destroyed; the identity of the authorized individual making each transaction; and the date, 
time, and duration of each transaction. Authorized individuals enter the details of their 
transactions at secure workstations requiring the use of confidential IDs and passwords. The 
secure workstations have dedicated connections to secure servers within the NEIDL data 
center. These servers have no access to the public internet or the internal firewalled BU 
network. Use of the laboratory data and information systems and access to the data and 
information are restricted to authorized individuals. Access to the NEIDL data center limited 
to authorized Information Technology, Public Safety and Lacilities personnel. 

3.3.2 Area Access Control for Protecting Select Agents and Toxin s 

NEIDL employees must display their IDs when entering the NEIDL grounds and at all times 
when on NEIDL property. Sharing of IDs with anyone is prohibited. 

Access control to the NEIDL facility, BSL-3 laboratories, ABSL-3 facilities, and BSL-4 suit 
rooms consists of proximity card readers at the entrance to the NEIDL facility and the entry 
doors to the BSL-3 laboratories, ABSL-3 facilities, and BSL-4 suit rooms. A biometric iris 
scanner controls access from the suit rooms to the entry door to the BSL-4 laboratories 
where Select Agents and Toxins are used and stored. Access to the BSL-4 suit rooms and 
laboratory spaces are limited to authorized individuals who have the appropriate training and 
security clearances. 
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■ Access to Laboratories is controlled and limited to individuals approved 
by the HHS Secretary or Administrator, following a security risk 
assessment by the Attorney General and authorized by the RO. 

■ Access to ABSL Suite is controlled. 

■ Animal Procedure and Animal Holding Rooms are controlled and all 
access from this point is limited to individuals approved by the HHS 
Secretary or Administrator, following a security risk assessment by the 
Attorney General and authorized by the RO. 

■ Access to Select Agent Storage Room is controlled and all access from 
this point is limited to individuals approved by the HHS Secretary or 
Administrator, following a security risk assessment by the Attorney 
General and authorized by the RO. 

■ Access to Storage Container is controlled on storage device/freezer and 
Pass through Boxes. 

The listed security barriers and devices are intended to deter, detect and delay an 
intruder from accessing a select agent or toxin while allowing sufficient time for 
responders to arrive. All entry doors controlled electronically and equipped with 
Intrusion Detection with two types of alarm. All alarms are monitored 24/7 at the 
NEIDL Security Command and Control Center. Response protocol includes visually 
inspecting CCTV of the area in alarm for suspicious activity and dispatching to 
investigate the alarm. The RO and EHS would be notified of any laboratory related 
issues and/or criminal activity. 

Animals that are intentionally or accidentally exposed to a select agent will be properly 
safeguarded from unauthorized access, theft, loss or release through the limited access 
measures described above. These infected animals and infected animal carcasses inside 
containment are secured, monitored and tracked according to Animal Science Core SOP 
on Daily Animal Tracking. In the event of a discovery of any problem with an animal or 
animals accidentally exposed or infected. Public Safety will be notified and the area 
containing the animal or animals will be immediately restricted until notification to the 
RO and appropriate measures are in place to investigate the matter. 

If in an emergency an authorized individual is not available and the incident is time- 
sensitive, the NEIDL Public Safety Supervisor will authorize access to the NEIDL facility 
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via the computerized access control system. This procedure will result in a NEIDL Public 
Safety Incident Report to document the authorization, the purpose of the entry, and the 
reason for the time-sensitive necessity. The Responsible Official, the NEIDL Director and 
Other key personnel will be notified of such events immediately. 

3.3.3 Container Access Control 

Container access control consists of a mechanical locking device designed to prevent access 
to a storage container for Select Agents and Toxins, such as a lockbox, refrigerator, or 
freezer. Locking devices are reviewed prior to selection and installation by representatives 
of Environmental Health & Safety and Public Safety. Access via mechanical locking device 
into the lockbox, refrigerator, or freezer is restricted to authorized individuals. When 
accessing a storage container, the authorized individuals must follow the two-person 
guideline as outlined in the Personal Suitability and Reliability Policy (attached). Access to 
inventoif storage retjuires two authorized personnel., 

Video cameras are positioned throughout the laboratories to monitor the storage 
containers and are displayed on monitors and can either be reviewed live time or, afterwards 
given digital recording. 

The Principal Investigator of a BSL-3 laboratory or BSL-4 suite is required to immediately 
notify the Responsible Official and NEIDL Public Safety at extension 4-4444 upon the 
termination of employment or access privileges for any authorized individual. The purpose 
of this notification is to remove the individual's access to all registered spaces and 
assess the need to change locking devices, combinations and PIN codes. In the event a 
combination or PIN is compromised. Public Safety will work with the PI and RO to 
immediately replace and/or change combination locks on pass through boxes and 
storage containers.. 

3.3.4 Suitability and Reliability 

Personnel suitability and reliability processes include both initial clearances and ongoing 
monitoring in accordance with federal regulations (42 CLR Part 73 , 7 CLR Part 331, and 9 
CLR Part 121) . These regulations describe procedures for conducting a pre-access suitability 
assessment of persons who will have access to a Tier 1 Select Agent or Toxin and have been 
addressed at BU in the Personal Suitability and Reliability Policy attached as Appendix A. 
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The following programs are implemented and reviewed accordingly: 

(1) Environmental Health & Safety coordinates efforts with Public Safety management to 
ensure security of Tier 1 Select Agents and Toxins and to share, as appropriate, relevant 
information. 

(2) EHS also monitors procedures for the ongoing assessment of the suitability of personnel 
with access to a Tier 1 Select Agent or Toxin. The procedures include: 

(i) Self- and peer-reporting of incidents or conditions that could affect an individual's 
ability to safely have access to or work with Select Agents and Toxins, or to safeguard 
Select Agents and Toxins from theft, loss, or release; 

(ii) Training of NEIDE employees with access to Tier 1 Select Agents and Toxins on 
NEIDE policies and procedures for reporting, evaluation, and corrective actions 
concerning the assessment of personnel suitability; and 

(iii) Implementation of ongoing suitability monitoring of individuals with access to Tier 1 
Select Agents and Toxins. 

3.3.5 Notification Procedures 

The Public Safety Operations Supervisor or his designee will be responsible for 
notifying external law enforcement agencies, including Federal, State and local 
authorities when necessary, of any suspicious activity or behavior that are criminal in 
nature, is detected in or around select agent locations. 

The Responsible Official will be notified by the Public Safety Operations Supervisor or 
his designee of all instances of suspicious activity or behavior, that are criminal in 
nature, occurring in or around select agent location or involving personnel engaged in 
activity related to the Boston University Select Agent Program. 

3.3.6 Normal SA Laboratory Operating Hours 

Select Agent Laboratory Normal Operating Hours are from 0630hrs - 2000hrs. The 
laboratory is accessible to employee authorized under 42 CFR 73.10 as long as they 
have received prior approval from the RO. This approval may be requested on an as 
needed basis for studies requiring after-hours access or in cases where frequent access 
may be necessary such as animal care technicians. The Public Safety Department will 
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provide the RO or his designee a card access report every thirty days identifying all 
access into the SA space twenty four hours a day for that time period. This report will 
be used to ensure compliance with laboratory operating hours. 

3.3.7 Visitors 

Visitors to the NEIDL will undergo a background screening using public access 
databases through a third party vendor. Visitors will not have access to any SA spaces 
and will be required to be escorted at all times. All visitors will undergo x-ray 
screening of their packages upon entry to the NEIDL. A list of prohibited items is 
posted at the NEIDL entry [see attached). Property lockers are located in the 
Pedestrian Gate House for the secure storage of visitor property. The Public Safety 
Operations Supervisor will approve or deny any requests for exceptions to this rule. 
Visitors are not permitted to bring personal vehicles onto the NEIDL site. 

4.0 AREA CLEANING, MAINTENANCE, AND REPAIR PERSONNEL 

Routine cleaning, maintenance, and repairs are restricted to areas of the NEIDL that are outside of the 
BSL-4 and BSL-3 laboratories. The NEIDL facilities and custodial personnel assigned to work in these 
restricted areas go through institutionally mandated clearances and biosafety and security training before 
receiving approval from BU Public Safety and the Responsible Official to begin their assignments. The 
facilities and custodial personnel will not receive authorization to enter an operational (“hot”) BSL-4 or 
BSL-3 suite. Access authorization to perform cleaning, maintenance, and repair functions in a BSL-4 or 
BSL-3 suite is permissible only after decommissioning and decontamination of the BSL-4 or BSL-3 suite. 
Routine cleaning and maintenance within restricted areas is done by the research staff in those areas in 
accordance with the Personal Suitability and Reliability Policy (attached). 

Maintenance within the BSL-4 suite is performed by those with clearance to enter the space or requires 
that a person with clearance escort the person performing the maintenance at all times. Such clearances 
are in accordance with 42 CLR 73.10 

5.0 INFORMATION SYSTEMS, RECORD MANAGEMENT AND CONTROL 
5.1 Information Systems 

The NEIDL acquires its network and Internet access via redundant high-speed fiber-optic 
connections to the Boston University (BU) trunk systems. BU Information Services & Technology 
(IS&T) staff include an Incident Response Team (IRT) that identifies and responds to security 
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issues that are actively identified on campus, notifies administrators of security breaches, and 
provides the University with forensic and auditing capabilities. The team actively coordinates with 
IS&T management to effect policy changes and enforcement, and works with the director of the 
NEIDL Information Technology and Telecommunications Core to mitigate risks and respond to 
emerging security issues. The team also develops tools and hones techniques for incident handling, 
develops strategies to increase the University’s detection and response capabilities, and maintains 
contacts with other universities and law enforcement. 

Within the NEIDL, the computer systems are separated into four distinct networks with increasing 
levels of security. One level is the desktop computer, which is commonly a wired connection and 
allows for unrestricted Internet access. Another level is for wireless devices (laptops, tablets, 
communication badges, smartphones, etc.); and this network uses the Institute of Electrical and 
Electronics Engineers (IEEE) 802. lx and WPA2 security protocols, which encrypt transmission of 
data packets. The NEIDL server network is “behind” the BU hardware firewall and access is 
restricted to specific authenticated users for scientific and administrative uses only. These servers 
do not have the ability to access the public internet. The final level is for building systems such as 
the building automation system (BAS), which is on its own internal network and has no 
connections to the Internet, the NEIDL server network, or desktop/laptop computing. These 
controls will prevent malicious code from compromising systems which manage access to 
registered spaces or select agent and toxin records. 

Access to Select Agent data and related information is acquired on an as-needed basis set forth by 
the BU Responsible Official (RO) and associated senior science staff of the NEIDL. Computer 
access to the Select Agent data is allowed only from specific non-networked computer terminals. 
These terminals are in full view of a recording camera and have “key logging” software installed to 
monitor use. Each user is also required to provide an additional tier of authentication, iris 
recognition, or ID card reader, to enter the computer terminal room. As the roles of the user are 
changed, the access to specific information on Select Agent storage and use will be adjusted to the 
new roles. Specific examples of this would be limitation of viewing Select Agent inventory for their 
work only, not accessing information systems of master stock or working stock quantity or storage 
locations. 

5.2 NEIDL Record Management and Control 

Record management comprises the planning, controlling, directing, organizing, training, promoting, 
and other managerial activities related to the lifecycle of records, which are conducted to achieve 
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adequate and proper documentation of NEIDL policies and transactions. 

A “record” is an information resource, in any format, that is: 

• created in the course of research, 

• received for action, or 

• needed to document NEIDL activities. 

Records are relevant books, papers, maps, photographs, machine readable materials, or other 
documentary materials, regardless of physical form or characteristics, made or received by the 
NEIDL in connection with the transaction of research. 

The NEIDL record’s lifecycle is the life span of a record from its creation or receipt to its final 
disposition, during which the following events occur: 


create/ 

receive 


> capture -^ close 


> retire* 


. transfer/ 
^ destroy 


active inactive 

maintenance / use 


opbonal * 


Records are to be managed and used throughout two lifecycle phases: 

• Active records are used to conduct current NEIDL research and are maintained in office 
space and equipment. 

• Inactive records are not needed for current research and are maintained in less critical off¬ 
site storage or deleted. 

Maintenance and control of the NEIDL records are under the direction of the Responsible Official. 
The Responsible Official ensures that all paper records pertaining to Select Agents and Toxins, 
including logbooks, are kept in locked files or containers and under the control of an authorized 
individual. The Public Safety Systems Integration Coordinator maintains and controls all building 
and security information records. The NEIDL Core Director of Information Technology and 
Telecommunications establishes and maintains protocols, in collaboration with the Public Safety 
Systems Integration Coordinator, to protect and store electronic information. These protocols 
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include backup security measures, and regular patching and updates to operating systems and 
individual applications used within the NEIDL. The information is backed up on a regular 
basis. 

6.0 RECEIPT AND HANDLING PROCEDURES 

An authorized individual who receives a BSL-3 or BSL-4 Select Agent or Toxin will verify receipt 
of the shipment and enter the identity and strain of the Select Agent or Toxin, the quantity received, 
and the date of receipt into the BSL-3 laboratory’s inventory control system or the BSL-4 suite’s 
inventory control system. After verification of its identity, the Select Agent or Toxin is placed and 
kept in secured storage except when in use and under the direct control of an authorized individual 
approved by the Responsible Official to possess, use, and transfer Select Agents and Toxins. The 
authorized individual can transfer a Select Agent or Toxin to another facility in accordance with 42 
CFR Part 73.16, Transfers, or destroy the Select Agent or Toxin on-site by autoclaving, 
incineration, or other recognized sterilization or neutralization process. The Principal Investigator 
must notify the Responsible Official of the decision to transfer or destroy a Select Agent or Toxin 
and the Responsible Official or his or her designee must witness the transfer or destruction. 

Records of all such actions are maintained in accordance with 42 CFR Part 72.15, Records. 

In the event an unexpected package or shipment of select agent materials arrives at the 
laboratory. Public Safety will be notified atX4-4444. Public Safety will secure the immediate 
area and isolate the package. The RO will be notified and attempts to ascertain information 
from the sender and/or recipient will be made. If the package appears suspicious in nature or 
displays any suspicious indicators external law enforcement will be notified to investigate. If 
no threat is detected Public Safety will work in collaboration with the RO and Environmental 
Health and Safety to safely and appropriately determine an action plan. 

7,0 INTERNAL TRANSPORT 

Authorized individuals approved by the Responsible Official can transport a Select Agent or Toxin 
from one BSL-3 laboratory to another BSL-3 laboratory and from one BSL-4 suite to another BSL- 
4 suite if the recipient authorized individual has met all requirements for obtaining and handling 
that Select Agent or Toxin. The authorized individual and recipient authorized individual must 
record the transfer in their respective BSL-4 suite electronic inventory control systems to document 
the chain of custody. Packaging of a Select Agent or Toxin for internal transport requires tertiary 
containment as specified in Section 16: Transportation Plan of BU’s Biological Laboratory Safety 
Permit Application. 
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8.0 POWER DISRUPTION 

The NEIDL is equipped with redundant forms of back-up power sources should there be a 
disruption in normal power. All of the security and access control devices, including card 
readers, Biometric IRIS readers, electronic handsets and closed circuit television [CCTV) 
cameras are supplied. All CCTV and intrusion detection is monitored 24x7 by NEIDL Public 
Safety Officers . In addition we have locations for systems monitoring. In the event of normal 
power interruptions all Select Agent area remain secure. The RO will be contacted in the 
event of power interruptions. A Public Safety Officer will be assigned to restrict and/or 
control access to any select agent location in the event of system failure or system damage. 

9.0 SECURITY TRAINING FOR AUTHORIZED INDIVIDUALS AND OTHER PERSONS 
ASSIGNED TO THE NEIDL 

All authorized individuals will receive security training before the Responsible Official approves 
their assignment to work in the NEIDL BSL-3 laboratories or BSL-4 suites, and before the 
Department of Public Safety will issue ID badges and proximity cards that allow entry into the 
NEIDL and the assigned BSL-4 suites. All operations, maintenance, and support personnel and 
Public Safety Officers whose general work assignments are restricted to non-containment areas of 
the NEIDL will receive security training before the Department of Public Safety will issue ID cards 
that allow entry into the NEIDL. The Department of Public Safety also requires that operations, 
maintenance, and support personnel and Public Safety Officers pass a Criminal Offender Record 
Background Information Check before receiving the security training and their assignment to work 
in the NEIDL. 

9.1 Security Training for Authorized Individuals 

The security training content for authorized individuals addresses: 1) identification of safety and 
security emergencies and security breaches, and methods for reporting them; 2) mandatory 
reporting requirements and those responsible for the reporting; 3) security procedures for entering 
the NEIDL; 4) security procedures for controlling access to Select Agents and Toxins; 5) security 
responsibilities for escorting unauthorized individuals while they are in the NEIDL; 6) inspection of 
packages that escorted individuals may carry when they leave the NEIDL; 7) safeguards that secure 
electronic Select Agents and Toxins inventory records and protect the confidentiality of sensitive 
information; and 8) security measures that are implemented when a release of a Select Agent or 
Toxin occurs. 

The security training program emphasizes that authorized individuals are required to 
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immediately report to the Responsible Official and the Executive Director of Public Safety any 
incident that involves: 1) the sharing, compromise, or loss of keys, badges, or passwords; 2) the loss 
of documentation, whether electronic or paper, which would provide specific information as to 
quantity, location, or access to Select Agents and Toxins; 3) any suspicious persons, packages, or 
activities that are observed at the NEIDL or at personal residences; 4) the loss or theft of a Select 
Agent or Toxin; 5) the release of a Select Agent or Toxin; and 6) any sign of an alteration or 
compromise of a Select Agent or Toxin inventory or use records. 

Individuals whose IDs are lost or left elsewhere do not get access until they have recovered or 
replaced ID credentials. Public Safety can replace an ID or facilitate the approval (with RO) of an 
authorized escort immediately. 

The training program provides specific instructions on how the authorized individual should report 
incidents and the nature of the incident response. For example, an incident report to the Responsible 
Official or the Executive Director of Public Safety involving the theft of a Select Agent will result 
in an immediate alert to the Boston University Police Department Detectives. The area will be 
secured and controlled by the on-scene NEIDL Public Safety Officer for evidence collection, if 
necessary. Public Safety may also notify the Boston University Police and other local, state, and 
federal agencies for assistance, as necessary. The Responsible Official will immediately notify the 
Boston Public Health Commission, Centers for Disease Control and Prevention, USDA, and others, 
as necessary, and will ensure availability of all BU records and personnel during ongoing 
investigations involving such agencies. 

On the report of a suspicious person or package. Public Safety Officers will immediately respond to 
the incident. Suspected alteration of inventory records will initiate a review by Public Safety of all 
relevant records. Public Safety will make the determination regarding whether or not there was an 
alteration of the records. 

Environmental Health & Safety provides training for the secure control of Select Agents and 
Toxins that are stored in lockboxes, refrigerators, and freezers within the BSE-3 laboratories and 
BSE-4 suites. EHS also reinforces biosafety training by addressing response procedures for an 
incident involving the release of a Select Agent or Toxin within a BSE-3 laboratory or BSE-4 suite. 

9.2 Security Training for Public Safety Officers 

Security training for Public Safety Officers includes an orientation course on the principles of 
biosafety and security. This course introduces basic concepts of biological safety, containment, and 
security, and addresses the particular needs of the individual, the work he or she will do, and the 
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risks posed by the Select Agents and Toxins. The course also emphasizes the security measures 
that control access to Select Agents and Toxins, and review safeguards that protect the public health 
from accidental and intentional release of a Select Agent or Toxin. Other relevant security training 
content addresses: 1) standard response protocols for encountering a suspicious person or package, 
including the use of the standard Field Investigation Observation interview procedures and arrest 
policies; 2) standard response protocols to isolate and secure an incident area, such as an area for 
medical emergency assistance involving BSL-3 laboratory personnel or BSL-4 suite personnel, and 
authorize escorted access to external first responders; and 3) standard protocols and procedures for 
controlling security incidents, such as workplace violence, protests and civil disturbances, bomb 
threats, hostage situations, and incidents that may involve authorized individuals at other campus 
locations. 

Training also includes drills to maintain high standards of excellence in emergency response team 
procedures to assist in securing a biocontainment exterior perimeter. Refresher training and drills 
occur annually. 

9.3 Security Training for Operations, Maintenance, and Support Personnel 

Security training for operations, maintenance, and support personnel includes the orientation course 
on the principles of biosafety and security described in Section 8.2 of this Plan. They receive 
additional instruction on: 1) security procedures for entering the NEIDL, including procedures for 
obtaining a NEIDL ID badge, and proximity card, if necessary; 2) response protocols for 
encountering a suspicious person or package; 3) identification of emergencies; and 4) response 
protocols for emergency incidents. 

9.4 Security Training for Escorted Persons 

A person authorized to enter NEIDL under escort must first take the basic orientation course on the 
principles of biosafety and security before Public Safety will provide a temporary ID badge and 
grant approval for entering the NEIDL. The NEIDL employee providing the escort will be mindful 
of the need to ensure that the escorted person adheres to all safety and security requirements that 
apply. The escorted person will relinquish the temporary ID badge upon exiting the NEIDL. No 
escorted person can enter a NEIDL BSL-3 laboratory or BSL-4 suite without: 1) the approval of the 
Responsible Official; 2) experience working in a BSL-3 laboratory or BSL-4 suite; and 3) being an 
authorized individual at another BSL-3 laboratory or BSL-4 facility. 
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10.0 ANNUAL REVIEW, DRILLS, AND EXERCISES 

The Public Safety department reviews and revises, as necessary, the NEIDL written Security Plan 
at least annually. Public Safety participates in drills and exercises each year in accordance with the 
NEIDL Comprehensive Emergency Management Plan to test and evaluate the effectiveness of the 
Plan, and revises the Plan as needed. 

11.0 DEFINITIONS 

Access: “Access” means having possession of a Select Agent or Toxin, or the ability to gain 
possession of a Select Agent or Toxin. 

Authorized Individual: “Authorized Individual” means a person whom the DHHS Secretary or 
USDA Animal and Plant Health Inspection Service (APHIS) Administrator, and the Responsible 
Official have approved to have access for the possession and use of Select Agents at the NEIDL.. 

Command Center: “Command Center” means the designated location for coordinating all 
communications during an emergency. 

Container: “Container” means a lockbox, refrigerator, or freezer for storing Select Agents and 
Toxins. 

EHS: “EHS” stands for Environmental Health & Safety, the Boston University department 
responsible for managing the Select Agent Program at the NEIDL. 

Principal Investigator: “Principal Investigator” means an authorized individual approved by the 
Responsible Official (RO) to direct a Select Agent or Toxin project or program and who is 
responsible for the scientific and technical direction of that project or program. 

Risk Assessment: “Risk Assessment” means a process using qualitative and quantitative 
techniques to assess: 1) the potential for loss, theft, or release of a Select Agent or Toxin from a 
containment laboratory; and 2) the risk to the public health from such loss, theft, or release. The 
risk assessment provides the basis for selecting security control measures to safeguard the public 
health. 

Responsible Official: The “Responsible Official” (RO) is an authorized individual with 
responsibility, authority, and control to ensure compliance with the DHHS and USDA Rules and 
Regulations pertaining to the possession, use, and transfer of Select Agents and Toxins. 
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Security: “Security” means both the biosecurity and physical security measures that protect Select 
Agents and Toxins, and critical relevant information, against loss, theft, and release. 

Select Agent: “Select Agent” means a biological agent or toxin that has the potential to pose a 
severe threat to public health and safety. The DHHS Secretary and the USDA Animal and Plant 
Health Inspection (APHIS) Service Administrator have responsibility for determining Select 
Agents. Select agents are listed in §73.3 of 42 CFR Part 73 and in §121.3 of 9 CFR Part 121 . 

Vulnerability: “Vulnerability” means a deficiency, exploitable capability, or weakness in the 
physical security system of a laboratory facility or in the implementation of security operational 
standards that could compromise the security of Select Agents and Toxins. 

12.0 KEY REFERENCES AND RESOURCES 

■ DHHS 42 CFR Part 73. Select Agents and Toxins 

■ USDA 7 CFR Part 331 . Possession, Use and Transfer of Select Agents and Toxins 

■ USDA 9 CFR Part 121. Possession, Use and Transfer of Select Agents and Toxins 

■ BUMC Department of Public Safety Policy and Procedure Manual 

■ BU Personnel Suitability and Reliability Policy 

■ NEIDL Comprehensive Emergency Management Plan 

■ Biosafety in Microbiological and Biomedical Laboratories (BMBL), U.S. Department of Health 

and Human Services. Centers for Disease Control and Prevention and National Institutes of 
Health. 5* Edition. 2009. Washington: U.S. Government Printing Office. 
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